Rogue MFA Providers Steal Passwords During Login

Security researchers have identified a new method for stealing user passwords during standard login attempts. The technique, known as TrustSink, allows attackers with existing high-level access to insert themselves into the authentication process. By registering a fake multi-factor authentication (MFA) provider, they can trick users into re-entering their credentials while the system still reports a successful sign-in.

The vulnerability relies on the trust cloud platforms place in third-party authentication services. When a user triggers a two-step verification, the platform redirects them to an external provider to complete the second factor. If that provider returns a valid token, the platform accepts the login. Attackers exploit this by registering a malicious provider that mimics the legitimate interface, capturing the password in plaintext before generating the success token.

Hidden interception in login flow

According to BleepingComputer, the attack works by abusing the external authentication model used by major identity platforms. The user begins a normal sign-in, entering their email and password on the official domain. When the system requests a second factor, the browser is redirected to the attacker’s rogue server instead of a legitimate verification service. The malicious server displays a copy of the standard password prompt, leading the victim to believe the platform is asking for additional verification.

The victim enters their password again, unaware that the input is being sent directly to the attacker. The rogue provider then generates a signed token indicating that the multi-factor requirement has been met. This token is returned to the main platform, which processes the login as successful. From the user’s perspective, the process appears seamless and normal, with no error messages or warnings displayed.

High-level access required

It is crucial to note that this is not an initial access attack. The attacker must already control a highly privileged account to register the rogue provider. This involves modifying authentication policies and creating specific service grants, actions that require significant administrative rights. Because the attack depends on prior compromise, it serves as a persistence mechanism rather than a way to break into a system from the outside.

The trade-off for organizations is that this method bypasses standard password reset protections. Researchers found that even after a user changed their password, the rogue provider remained active in the authentication flow. It captured the new password during the next sign-in attempt. This persistence makes the threat particularly dangerous for enterprises that rely heavily on external MFA providers for their security architecture.

Building on prior research

The TrustSink technique builds on earlier findings by security researcher Dirk-Jan Mollema. Previous work demonstrated how a rogue provider could satisfy MFA requirements by returning a valid token without performing any actual authentication checks. The new research extends this concept by adding the element of credential theft. The visual fidelity of the fake prompt, which matches the official design in fonts and layout, ensures that users are less likely to suspect the redirection.

The attack exploits the natural expectation of an additional step during login. Because users are already in a state of heightened attention, expecting a verification code or prompt, the fake password request blends seamlessly into the experience. This psychological element, combined with the technical validation of the token, creates a robust method for harvesting credentials from compromised environments.